diff --git a/crypto-policies.spec b/crypto-policies.spec
index a0a2ecb..fbefc30 100644
--- a/crypto-policies.spec
+++ b/crypto-policies.spec
@@ -1,12 +1,12 @@
-%global git_date 20250404
-%global git_commit ca0e9a587dba7a0a62153ad6e9541b18e453a31b
+%global git_date 20250424
+%global git_commit 9267deef3c75cf56ea61910287e1eab47454b208
 %{?git_commit:%global git_commit_hash %(c=%{git_commit}; echo ${c:0:7})}
 
 %global _python_bytecompile_extra 0
 
 Name:           crypto-policies
 Version:        %{git_date}
-Release:        4.git%{git_commit_hash}%{?dist}
+Release:        1.git%{git_commit_hash}%{?dist}
 Summary:        System-wide crypto policies
 
 License:        LGPL-2.1-or-later
@@ -57,20 +57,6 @@ defined in simple policy definition files.
 The package also provides a tool fips-mode-setup, which can be used
 to enable or disable the system FIPS mode.
 
-%package pq-preview
-Summary: Post-quantum crypto-policies [Technology Preview]
-Requires: %{name} = %{version}-%{release}
-Requires: (oqsprovider or openssl >= 1:3.5)
-
-%description pq-preview
-This package TEST-PQ subpolicy policy with postquantum algorithms enabled.
-It also depends on liboqs and oqs-provider to ensure they're installed.
-
-This package is part of a Technology Preview.
-Technology Preview features are not fully supported,
-may not be functionally complete,
-and are not suitable for deployment in production.
-
 %prep
 %setup -q -n fedora-crypto-policies-%{git_commit_hash}-%{git_commit}
 %autopatch -p1
@@ -86,7 +72,7 @@ sed -i "s/:TLS-REQUIRE-EMS:/:/" tests/outputs/*FIPS*.txt
 %if 0%{?rhel} == 11
 # currently ELN NSS doesn't support mlkem768secp256r1
 sed -i '/P256-MLKEM768/d' python/policygenerators/nss.py
-sed -i "s/:mlkem768secp256r1:/:/" tests/outputs/*:TEST-PQ-nss.txt
+sed -i "s/:mlkem768secp256r1:/:/" tests/outputs/*-nss.txt
 %endif
 
 %make_build
@@ -235,8 +221,9 @@ exit 0
 %{_datarootdir}/crypto-policies/policies/modules/AD-SUPPORT.pmod
 %{_datarootdir}/crypto-policies/policies/modules/ECDHE-ONLY.pmod
 %{_datarootdir}/crypto-policies/policies/modules/NO-ENFORCE-EMS.pmod
+%{_datarootdir}/crypto-policies/policies/modules/NO-PQ.pmod
 %{_datarootdir}/crypto-policies/policies/modules/OSPP.pmod
-# but not TEST-PQ
+%{_datarootdir}/crypto-policies/policies/modules/TEST-PQ.pmod
 
 %{_libexecdir}/fips-setup-helper
 %{_libexecdir}/fips-crypto-policy-overlay
@@ -249,11 +236,14 @@ exit 0
 %{_mandir}/man8/update-crypto-policies.8*
 %{_datarootdir}/crypto-policies/python
 
-%files pq-preview
-%{_datarootdir}/crypto-policies/policies/modules/TEST-PQ.pmod
-
 
 %changelog
+* Thu Apr 24 2025 Alexander Sosedkin <asosedkin@redhat.com> - 20250424-1.git9267dee
+- LEGACY/DEFAULT/FUTURE: enable hybrid ML-KEM and pure ML-DSA
+- drop crypto-policies-pq-preview subpackage, TEST-PQ goes into main one
+- NO-PQ: introduce
+- openssl: fix enabling integrity-only ciphersuites (still need min_rsa_size=0)
+
 * Mon Apr 22 2025 Alexander Sosedkin <asosedkin@redhat.com> - 20250404-4.gitca0e9a5
 - Fix accidental turning of oqsprovider BuildRequires into Requires
 - Drop requires on liboqs
diff --git a/sources b/sources
index 30e7cb3..5807bc4 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (crypto-policies-gitca0e9a5.tar.gz) = 8518aac01cde2a978bec78e27cc070c06d560b0efab9f40c37b91dfb865672b1cd5d222b7578fc06e86f93ca25e679f8064ffec16e3bca37cd82d140d5d86367
+SHA512 (crypto-policies-git9267dee.tar.gz) = f647f8dc845ee79b3a9204642d01a4cd459a5b4476b364bd5702b6987bf2698304d7aefa7ac40b2cc9b7718b4781cfb12d688dc750144b9dc5529a41ef948024